UNM Health Cyber Incident Shows How Quickly Hospital Operations Can Unravel

UNM Health Cyber Incident Shows How Quickly Hospital Operations Can Unravel

The University of New Mexico Health System disclosed a cybersecurity incident on October 26 that forced it to divert ambulance traffic, cancel appointments across more than 30 clinics, and close parts of the University of New Mexico Health Sciences Center.

That operational impact matters even before investigators can say whether patient records were accessed. UNM operates New Mexico's only Level 1 trauma center, so taking clinical systems offline immediately became a patient-safety and regional-capacity problem, not merely an IT outage.

What is confirmed

UNM Health said its security teams were working to resolve a cybersecurity issue affecting the Health Sciences Center. Its initial notice told patients not to report to facilities, directed emergencies to 911, and said non-emergency care should be delayed. The university also sent non-essential personnel and students home.

The Associated Press reported that operations began resuming in phases later that day, while the incident remained under investigation. The FBI said it was assisting a partner agency. UNM has not publicly confirmed the attack method, the identity of an actor, or whether patient data was accessed.

That distinction is important. Employee reports and media accounts described messages claiming that student, employee, and patient information had been stolen, but those claims are not a substitute for forensic confirmation. Healthcare organizations should communicate what is known, what is being investigated, and what patients should do without turning an allegation into a confirmed data breach.

Why the first hours are operationally difficult

Hospitals cannot simply switch off every connected system and continue normally. Clinical records, imaging, laboratory workflows, medication access, identity services, communications, building controls, and scheduling systems are interdependent. A defensive shutdown can therefore produce the same immediate symptom as an attack: slower care and reduced capacity.

The incident is a reminder that incident response in healthcare must include clinical continuity. A technically successful containment step is incomplete if clinicians do not have tested paper procedures, trusted downtime forms, alternate communications, and a safe process for reconciling records after systems return.

What defenders should do now

Healthcare security teams should treat this as a live investigation rather than wait for a public attribution:

1. Preserve evidence before rebuilding. Capture endpoint, identity, network, email, EDR, VPN, and application logs, including systems that were powered down or isolated.
2. Separate containment from recovery. Restrict affected accounts and segments, but restore only from known-good images and validate administrative access before reconnecting clinical networks.
3. Hunt for identity abuse. Review privileged sign-ins, new MFA methods, password resets, service accounts, remote tools, and unusual access to electronic health records.
4. Protect patients from secondary fraud. Until the investigation establishes the facts, prepare clear guidance about suspicious calls, password resets, and messages impersonating UNM or healthcare providers.
5. Exercise downtime operations. Test whether emergency departments, pharmacies, laboratories, imaging teams, and partner hospitals can coordinate when core systems are unavailable.

The UNM disruption demonstrates why hospital resilience cannot be measured only by whether malware is removed. The more consequential question is whether care can continue safely while the organization determines what happened. In healthcare, recovery planning is part of cybersecurity—not a separate business-continuity exercise.

References

1. Ambulance Traffic Diverted, Clinical Appointments Cancelled and Classes Cancelled Due to Cybersecurity Issue at UNM HSC
2. A cybersecurity issue forces a major New Mexico hospital to divert patients and close clinics
3. UNM Health Sciences Center newsroom